gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Plan secure bootstrap and privileged installation

Browse Source
This commit is contained in:
Gabriel Brown
2026-08-27 03:11:00 -04:00
parent b361db8486
commit bfb37afd69
4 changed files with 1322 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/superpowers/specs/2026-08-27-secure-bootstrap-privileged-installation-design.md
+11 -6
View File
@@ -181,7 +181,7 @@ Create `setup/lib/artifact-provenance` with only these public shell functions:
```text
key_fingerprint_matches FILE EXPECTED_FINGERPRINT
download_sha256 URL EXPECTED_SHA256 DESTINATION
download_sha256 URL EXPECTED_SHA256 MAX_BYTES DESTINATION
verify_detached_signature KEY_FILE SIGNATURE_FILE CONTENT_FILE
rpm_signature_matches PACKAGE_FILE KEY_FILE EXPECTED_FINGERPRINT
```
@@ -211,6 +211,7 @@ As reviewed on 2026-08-27, the trust anchors are:
| RPM Fusion nonfree | `79BDB88F9BBF73910FD4095B6A2AF96194843C65` |
| lionheartp/Hyprland COPR | `97E23476C89635135407C7D5E9BA41342C4B2995` |
| Flathub | `6E5C05D979C76DAF93C081354184DD4D907A7CAE` |
| Claude Desktop Extra | `825A7D15D78BABE45646D5DF382409F597908867` |
The initial reviewed artifact pins are:
@@ -245,6 +246,8 @@ The provenance README cites these publisher-controlled records:
- Hyprland COPR key:
`https://download.copr.fedorainfracloud.org/results/lionheartp/Hyprland/pubkey.gpg`;
- Flathub descriptor: `https://flathub.org/repo/flathub.flatpakrepo`;
- Claude Desktop Extra key:
`https://patrickjaja.github.io/claude-desktop-extra/gpg-key.asc`;
- Node release and verification instructions:
`https://github.com/nodejs/node/releases/tag/v24.20.0` and
`https://github.com/nodejs/node/blob/main/README.md`;
@@ -263,8 +266,10 @@ The provenance README cites these publisher-controlled records:
`terra.repo_gpgcheck=1`, and the local pinned key with the official repository.
Failure stops before initial, desktop, or Hyprland package transactions.
- Hyprland COPR configuration is written from reviewed local data with the exact
base URL, `gpgcheck=1`, `repo_gpgcheck=1`, and pinned project key. Panama does not
use interactive/TOFU `dnf copr enable -y`.
base URL, `gpgcheck=1`, and the pinned project key. The publisher does not provide
`repomd.xml.asc`, so this repository has an explicit `repo_gpgcheck=0` exception;
package signatures remain mandatory. Panama does not use interactive/TOFU
`dnf copr enable -y`.
- Flathub's descriptor is downloaded as data. Panama decodes and verifies its embedded
primary key and requires GPG verification before adding or retaining the remote.
A mismatch preserves an existing remote and skips Flathub transactions.
@@ -289,9 +294,9 @@ that depend on it.
- RustDesk uses the reviewed versioned RPM URL and SHA-256 before the narrow sudo DNF
install. It never resolves `latest` at runtime.
- Claude Desktop repository setup is never downloaded or executed. If an existing
repository has the expected base URL, key, `gpgcheck=1`, and `repo_gpgcheck=1`,
Panama may install from it. Otherwise it prints one optional manual step and
continues successfully.
repository has the expected base URL, vendored-key fingerprint, `gpgcheck=1`, and
`repo_gpgcheck=1`, Panama may install from it. Otherwise it prints one optional
manual step and continues successfully.
- Vicinae extensions use `npm ci`; lock mismatch fails the extension build without
modifying the tracked lockfile.